1

Does anyone recommend (or have a netstat script) that will print the IP sending the most of X (where X is FIN_WAIT, SYN_RECV, etc.).

Like, I have this

netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n

Which will nicely print out:

  1 CLOSE_WAIT
  1 established)
  1 Foreign
  3 FIN_WAIT1
  3 LAST_ACK
 13 ESTABLISHED
 17 LISTEN
154 FIN_WAIT2
327 TIME_WAIT

But I don't know how to figure out which IP is sending the most TIME_WAITs.

1

netstat -nat | awk '/TIME_WAIT/ { sub(/:[0-9]+/, "", $5); print $5 }' | sort | uniq -c | sort -rn | head

  • incredible!! :) – kidcapital Mar 13 '13 at 5:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.